@kensio/yulin 0.37.0 → 0.39.0

package/dist/service/cloudformation/resource/cfn/route53/sim-route53-cfn-value-adapter.d.ts

@@ -0,0 +1,6 @@
+import type { SimCfnResourceValueAdapterProperties, SimCfnServiceValueAdapter } from "../sim-cfn-resource-value-adapter.js";
+/**
+ * The CloudFormation-facing value adapter for a simulated Route 53 Resource.
+ */
+export declare function route53ValueAdapter(properties: SimCfnResourceValueAdapterProperties): SimCfnServiceValueAdapter;
+//# sourceMappingURL=sim-route53-cfn-value-adapter.d.ts.map

package/dist/service/cloudformation/resource/cfn/route53/sim-route53-cfn-value-adapter.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-route53-cfn-value-adapter.d.ts","sourceRoot":"","sources":["../../../../../../src/service/cloudformation/resource/cfn/route53/sim-route53-cfn-value-adapter.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EACV,oCAAoC,EACpC,yBAAyB,EAC1B,MAAM,sCAAsC,CAAC;AAE9C;;GAEG;AACH,wBAAgB,mBAAmB,CACjC,UAAU,EAAE,oCAAoC,GAC/C,yBAAyB,CAS3B"}

package/dist/service/cloudformation/resource/cfn/route53/sim-route53-cfn-value-adapter.js

@@ -0,0 +1,13 @@
+import { SimRoute53HostedZone } from "../../../../route53/hosted-zone/sim-route53-hosted-zone.js";
+import { SimRoute53HostedZoneCfn } from "./sim-route53-hosted-zone-cfn.js";
+/**
+ * The CloudFormation-facing value adapter for a simulated Route 53 Resource.
+ */
+export function route53ValueAdapter(properties) {
+    if (properties.type === "AWS::Route53::HostedZone" &&
+        properties.simResource instanceof SimRoute53HostedZone) {
+        return new SimRoute53HostedZoneCfn({ hostedZone: properties.simResource });
+    }
+    return undefined;
+}
+//# sourceMappingURL=sim-route53-cfn-value-adapter.js.map

package/dist/service/cloudformation/resource/cfn/route53/sim-route53-cfn-value-adapter.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-route53-cfn-value-adapter.js","sourceRoot":"","sources":["../../../../../../src/service/cloudformation/resource/cfn/route53/sim-route53-cfn-value-adapter.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,oBAAoB,EAAE,MAAM,4DAA4D,CAAC;AAClG,OAAO,EAAE,uBAAuB,EAAE,MAAM,kCAAkC,CAAC;AAM3E;;GAEG;AACH,MAAM,UAAU,mBAAmB,CACjC,UAAgD;IAEhD,IACE,UAAU,CAAC,IAAI,KAAK,0BAA0B;QAC9C,UAAU,CAAC,WAAW,YAAY,oBAAoB,EACtD,CAAC;QACD,OAAO,IAAI,uBAAuB,CAAC,EAAE,UAAU,EAAE,UAAU,CAAC,WAAW,EAAE,CAAC,CAAC;IAC7E,CAAC;IAED,OAAO,SAAS,CAAC;AACnB,CAAC"}

package/dist/service/cloudformation/resource/cfn/s3/sim-s3-cfn-value-adapter.d.ts

@@ -0,0 +1,6 @@
+import type { SimCfnResourceValueAdapterProperties, SimCfnServiceValueAdapter } from "../sim-cfn-resource-value-adapter.js";
+/**
+ * The CloudFormation-facing value adapter for a simulated S3 Resource.
+ */
+export declare function s3ValueAdapter(properties: SimCfnResourceValueAdapterProperties): SimCfnServiceValueAdapter;
+//# sourceMappingURL=sim-s3-cfn-value-adapter.d.ts.map

package/dist/service/cloudformation/resource/cfn/s3/sim-s3-cfn-value-adapter.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-s3-cfn-value-adapter.d.ts","sourceRoot":"","sources":["../../../../../../src/service/cloudformation/resource/cfn/s3/sim-s3-cfn-value-adapter.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EACV,oCAAoC,EACpC,yBAAyB,EAC1B,MAAM,sCAAsC,CAAC;AAE9C;;GAEG;AACH,wBAAgB,cAAc,CAC5B,UAAU,EAAE,oCAAoC,GAC/C,yBAAyB,CAS3B"}

package/dist/service/cloudformation/resource/cfn/s3/sim-s3-cfn-value-adapter.js

@@ -0,0 +1,13 @@
+import { SimS3Bucket } from "../../../../s3/bucket/sim-s3-bucket.js";
+import { SimS3BucketCfn } from "./sim-s3-bucket-cfn.js";
+/**
+ * The CloudFormation-facing value adapter for a simulated S3 Resource.
+ */
+export function s3ValueAdapter(properties) {
+    if (properties.type === "AWS::S3::Bucket" &&
+        properties.simResource instanceof SimS3Bucket) {
+        return new SimS3BucketCfn({ bucket: properties.simResource });
+    }
+    return undefined;
+}
+//# sourceMappingURL=sim-s3-cfn-value-adapter.js.map

package/dist/service/cloudformation/resource/cfn/s3/sim-s3-cfn-value-adapter.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-s3-cfn-value-adapter.js","sourceRoot":"","sources":["../../../../../../src/service/cloudformation/resource/cfn/s3/sim-s3-cfn-value-adapter.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,MAAM,wCAAwC,CAAC;AACrE,OAAO,EAAE,cAAc,EAAE,MAAM,wBAAwB,CAAC;AAMxD;;GAEG;AACH,MAAM,UAAU,cAAc,CAC5B,UAAgD;IAEhD,IACE,UAAU,CAAC,IAAI,KAAK,iBAAiB;QACrC,UAAU,CAAC,WAAW,YAAY,WAAW,EAC7C,CAAC;QACD,OAAO,IAAI,cAAc,CAAC,EAAE,MAAM,EAAE,UAAU,CAAC,WAAW,EAAE,CAAC,CAAC;IAChE,CAAC;IAED,OAAO,SAAS,CAAC;AACnB,CAAC"}

package/dist/service/cloudformation/resource/cfn/secretsmanager/sim-secrets-manager-cfn-value-adapter.d.ts

@@ -0,0 +1,7 @@
+import type { SimCfnResourceValueAdapterProperties, SimCfnServiceValueAdapter } from "../sim-cfn-resource-value-adapter.js";
+/**
+ * The CloudFormation-facing value adapter for a simulated Secrets Manager
+ * Resource.
+ */
+export declare function secretsManagerValueAdapter(properties: SimCfnResourceValueAdapterProperties): SimCfnServiceValueAdapter;
+//# sourceMappingURL=sim-secrets-manager-cfn-value-adapter.d.ts.map

package/dist/service/cloudformation/resource/cfn/secretsmanager/sim-secrets-manager-cfn-value-adapter.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-secrets-manager-cfn-value-adapter.d.ts","sourceRoot":"","sources":["../../../../../../src/service/cloudformation/resource/cfn/secretsmanager/sim-secrets-manager-cfn-value-adapter.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EACV,oCAAoC,EACpC,yBAAyB,EAC1B,MAAM,sCAAsC,CAAC;AAE9C;;;GAGG;AACH,wBAAgB,0BAA0B,CACxC,UAAU,EAAE,oCAAoC,GAC/C,yBAAyB,CAS3B"}

package/dist/service/cloudformation/resource/cfn/secretsmanager/sim-secrets-manager-cfn-value-adapter.js

@@ -0,0 +1,14 @@
+import { SimSecretsManagerSecret } from "../../../../secretsmanager/secret/sim-secrets-manager-secret.js";
+import { SimSecretsManagerSecretCfn } from "./sim-secrets-manager-secret-cfn.js";
+/**
+ * The CloudFormation-facing value adapter for a simulated Secrets Manager
+ * Resource.
+ */
+export function secretsManagerValueAdapter(properties) {
+    if (properties.type === "AWS::SecretsManager::Secret" &&
+        properties.simResource instanceof SimSecretsManagerSecret) {
+        return new SimSecretsManagerSecretCfn({ secret: properties.simResource });
+    }
+    return undefined;
+}
+//# sourceMappingURL=sim-secrets-manager-cfn-value-adapter.js.map

package/dist/service/cloudformation/resource/cfn/secretsmanager/sim-secrets-manager-cfn-value-adapter.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-secrets-manager-cfn-value-adapter.js","sourceRoot":"","sources":["../../../../../../src/service/cloudformation/resource/cfn/secretsmanager/sim-secrets-manager-cfn-value-adapter.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,uBAAuB,EAAE,MAAM,iEAAiE,CAAC;AAC1G,OAAO,EAAE,0BAA0B,EAAE,MAAM,qCAAqC,CAAC;AAMjF;;;GAGG;AACH,MAAM,UAAU,0BAA0B,CACxC,UAAgD;IAEhD,IACE,UAAU,CAAC,IAAI,KAAK,6BAA6B;QACjD,UAAU,CAAC,WAAW,YAAY,uBAAuB,EACzD,CAAC;QACD,OAAO,IAAI,0BAA0B,CAAC,EAAE,MAAM,EAAE,UAAU,CAAC,WAAW,EAAE,CAAC,CAAC;IAC5E,CAAC;IAED,OAAO,SAAS,CAAC;AACnB,CAAC"}

package/dist/service/cloudformation/resource/cfn/secretsmanager/sim-secrets-manager-secret-cfn.d.ts

@@ -0,0 +1,24 @@
+import type { SimSecretsManagerSecret } from "../../../../secretsmanager/secret/sim-secrets-manager-secret.js";
+import type { SimCfnTemplateValue } from "../../../template/value/sim-cfn-template-value.js";
+import type { SimCfnResourceValueAdapter } from "../sim-cfn-resource-value-adapter.js";
+interface SimSecretsManagerSecretCfnProperties {
+    readonly secret: SimSecretsManagerSecret;
+}
+/**
+ * CloudFormation-facing values for a simulated Secrets Manager secret.
+ */
+export declare class SimSecretsManagerSecretCfn implements SimCfnResourceValueAdapter {
+    private readonly secret;
+    constructor(properties: SimSecretsManagerSecretCfnProperties);
+    /**
+     * AWS::SecretsManager::Secret Ref returns the full secret ARN, random
+     * suffix and all, which is what makes a Ref usable as a SecretId.
+     */
+    refValue(): SimCfnTemplateValue;
+    /**
+     * AWS::SecretsManager::Secret attributes supported by the simulator.
+     */
+    attributeValue(attributeName: string): SimCfnTemplateValue;
+}
+export {};
+//# sourceMappingURL=sim-secrets-manager-secret-cfn.d.ts.map

package/dist/service/cloudformation/resource/cfn/secretsmanager/sim-secrets-manager-secret-cfn.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-secrets-manager-secret-cfn.d.ts","sourceRoot":"","sources":["../../../../../../src/service/cloudformation/resource/cfn/secretsmanager/sim-secrets-manager-secret-cfn.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,iEAAiE,CAAC;AAC/G,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,mDAAmD,CAAC;AAC7F,OAAO,KAAK,EAAE,0BAA0B,EAAE,MAAM,sCAAsC,CAAC;AAEvF,UAAU,oCAAoC;IAC5C,QAAQ,CAAC,MAAM,EAAE,uBAAuB,CAAC;CAC1C;AAED;;GAEG;AACH,qBAAa,0BAA2B,YAAW,0BAA0B;IAC3E,OAAO,CAAC,QAAQ,CAAC,MAAM,CAA0B;IAEjD,YAAY,UAAU,EAAE,oCAAoC,EAE3D;IAED;;;OAGG;IACH,QAAQ,IAAI,mBAAmB,CAE9B;IAED;;OAEG;IACH,cAAc,CAAC,aAAa,EAAE,MAAM,GAAG,mBAAmB,CAWzD;CACF"}

package/dist/service/cloudformation/resource/cfn/secretsmanager/sim-secrets-manager-secret-cfn.js

@@ -0,0 +1,30 @@
+/**
+ * CloudFormation-facing values for a simulated Secrets Manager secret.
+ */
+export class SimSecretsManagerSecretCfn {
+    secret;
+    constructor(properties) {
+        this.secret = properties.secret;
+    }
+    /**
+     * AWS::SecretsManager::Secret Ref returns the full secret ARN, random
+     * suffix and all, which is what makes a Ref usable as a SecretId.
+     */
+    refValue() {
+        return this.secret.arn.value;
+    }
+    /**
+     * AWS::SecretsManager::Secret attributes supported by the simulator.
+     */
+    attributeValue(attributeName) {
+        switch (attributeName) {
+            case "Id": {
+                return this.secret.arn.value;
+            }
+            default: {
+                throw new Error(`Unsupported AWS::SecretsManager::Secret attribute ${attributeName}`);
+            }
+        }
+    }
+}
+//# sourceMappingURL=sim-secrets-manager-secret-cfn.js.map

package/dist/service/cloudformation/resource/cfn/secretsmanager/sim-secrets-manager-secret-cfn.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sim-secrets-manager-secret-cfn.js","sourceRoot":"","sources":["../../../../../../src/service/cloudformation/resource/cfn/secretsmanager/sim-secrets-manager-secret-cfn.ts"],"names":[],"mappings":"AAQA;;GAEG;AACH,MAAM,OAAO,0BAA0B;IACpB,MAAM,CAA0B;IAEjD,YAAY,UAAgD;QAC1D,IAAI,CAAC,MAAM,GAAG,UAAU,CAAC,MAAM,CAAC;IAClC,CAAC;IAED;;;OAGG;IACH,QAAQ;QACN,OAAO,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC;IAC/B,CAAC;IAED;;OAEG;IACH,cAAc,CAAC,aAAqB;QAClC,QAAQ,aAAa,EAAE,CAAC;YACtB,KAAK,IAAI,EAAE,CAAC;gBACV,OAAO,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC;YAC/B,CAAC;YACD,SAAS,CAAC;gBACR,MAAM,IAAI,KAAK,CACb,qDAAqD,aAAa,EAAE,CACrE,CAAC;YACJ,CAAC;QACH,CAAC;IACH,CAAC;CACF"}

package/dist/service/cloudformation/resource/cfn/sim-cfn-resource-value-adapter.d.ts

@@ -3,18 +3,27 @@ export interface SimCfnResourceValueAdapter {
     refValue(): SimCfnTemplateValue;
     attributeValue(attributeName: string): SimCfnTemplateValue;
 }
-interface SimCfnResourceValueAdapterProperties {
+export interface SimCfnResourceValueAdapterProperties {
     readonly logicalId: string;
     readonly type: string | undefined;
     readonly simResource: object | undefined;
 }
+/**
+ * The adapter for a Resource type one service owns, or nothing when the
+ * Resource belongs to another service.
+ */
+export type SimCfnServiceValueAdapter = SimCfnResourceValueAdapter | undefined;
 /**
  * Build the CloudFormation-facing value adapter for a created simulated
  * Resource.
  *
  * The underlying simulated AWS service object stays service-focused; this
  * adapter owns CloudFormation-specific Ref and Fn::GetAtt behavior.
+ *
+ * Each service matches its own Resource types, beside that service's adapters,
+ * so this registry stays a list of services. A Resource no service claims
+ * falls through to the default adapter, which answers a Ref with the logical
+ * ID.
  */
 export declare function simCfnResourceValueAdapter(properties: SimCfnResourceValueAdapterProperties): SimCfnResourceValueAdapter;
-export {};
 //# sourceMappingURL=sim-cfn-resource-value-adapter.d.ts.map

package/dist/service/cloudformation/resource/cfn/sim-cfn-resource-value-adapter.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"sim-cfn-resource-value-adapter.d.ts","sourceRoot":"","sources":["../../../../../src/service/cloudformation/resource/cfn/sim-cfn-resource-value-adapter.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,gDAAgD,CAAC;AAqB1F,MAAM,WAAW,0BAA0B;IACzC,QAAQ,IAAI,mBAAmB,CAAC;IAEhC,cAAc,CAAC,aAAa,EAAE,MAAM,GAAG,mBAAmB,CAAC;CAC5D;AAED,UAAU,oCAAoC;IAC5C,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,IAAI,EAAE,MAAM,GAAG,SAAS,CAAC;IAClC,QAAQ,CAAC,WAAW,EAAE,MAAM,GAAG,SAAS,CAAC;CAC1C;AAED;;;;;;GAMG;AACH,wBAAgB,0BAA0B,CACxC,UAAU,EAAE,oCAAoC,GAC/C,0BAA0B,CA+E5B"}
+{"version":3,"file":"sim-cfn-resource-value-adapter.d.ts","sourceRoot":"","sources":["../../../../../src/service/cloudformation/resource/cfn/sim-cfn-resource-value-adapter.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,gDAAgD,CAAC;AAW1F,MAAM,WAAW,0BAA0B;IACzC,QAAQ,IAAI,mBAAmB,CAAC;IAEhC,cAAc,CAAC,aAAa,EAAE,MAAM,GAAG,mBAAmB,CAAC;CAC5D;AAED,MAAM,WAAW,oCAAoC;IACnD,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,IAAI,EAAE,MAAM,GAAG,SAAS,CAAC;IAClC,QAAQ,CAAC,WAAW,EAAE,MAAM,GAAG,SAAS,CAAC;CAC1C;AAED;;;GAGG;AACH,MAAM,MAAM,yBAAyB,GAAG,0BAA0B,GAAG,SAAS,CAAC;AAE/E;;;;;;;;;;;GAWG;AACH,wBAAgB,0BAA0B,CACxC,UAAU,EAAE,oCAAoC,GAC/C,0BAA0B,CAc5B"}

package/dist/service/cloudformation/resource/cfn/sim-cfn-resource-value-adapter.js

@@ -1,82 +1,35 @@
-import { SimS3Bucket } from "../../../s3/bucket/sim-s3-bucket.js";
-import { SimS3BucketCfn } from "./s3/sim-s3-bucket-cfn.js";
+import { acmValueAdapter } from "./acm/sim-acm-cfn-value-adapter.js";
+import { cloudFrontValueAdapter } from "./cloudfront/sim-cloudfront-cfn-value-adapter.js";
+import { iamValueAdapter } from "./iam/sim-iam-cfn-value-adapter.js";
+import { kmsValueAdapter } from "./kms/sim-kms-cfn-value-adapter.js";
+import { lambdaValueAdapter } from "./lambda/sim-lambda-cfn-value-adapter.js";
+import { route53ValueAdapter } from "./route53/sim-route53-cfn-value-adapter.js";
+import { s3ValueAdapter } from "./s3/sim-s3-cfn-value-adapter.js";
+import { secretsManagerValueAdapter } from "./secretsmanager/sim-secrets-manager-cfn-value-adapter.js";
 import { SimCfnDefaultResourceValueAdapter } from "./sim-cfn-default-resource-value-adapter.js";
-import { SimCloudFrontDistribution } from "../../../cloudfront/distribution/sim-cloudfront-distribution.js";
-import { SimCloudFrontDistributionCfn } from "./cloudfront/sim-cloudfront-distribution-cfn.js";
-import { SimCloudFrontFunction } from "../../../cloudfront/cff/sim-cloudfront-function.js";
-import { SimCloudFrontFunctionCfn } from "./cloudfront/sim-cloudfront-function-cfn.js";
-import { SimRoute53HostedZone } from "../../../route53/hosted-zone/sim-route53-hosted-zone.js";
-import { SimRoute53HostedZoneCfn } from "./route53/sim-route53-hosted-zone-cfn.js";
-import { SimAcmCertificateCfn } from "./acm/sim-acm-certificate-cfn.js";
-import { SimAcmCertificate } from "../../../acm/certificate/sim-acm-certificate.js";
-import { SimIamManagedPolicyCfn } from "./iam/sim-iam-managed-policy-cfn.js";
-import { SimIamRoleCfn } from "./iam/sim-iam-role-cfn.js";
-import { SimLambdaFunction } from "../../../lambda/function/sim-lambda-function.js";
-import { SimLambdaFunctionCfn } from "./lambda/sim-lambda-function-cfn.js";
-import { SimLambdaFunctionUrl } from "../../../lambda/function/url/sim-lambda-function-url.js";
-import { SimLambdaFunctionUrlCfn } from "./lambda/sim-lambda-function-url-cfn.js";
 /**
  * Build the CloudFormation-facing value adapter for a created simulated
  * Resource.
  *
  * The underlying simulated AWS service object stays service-focused; this
  * adapter owns CloudFormation-specific Ref and Fn::GetAtt behavior.
+ *
+ * Each service matches its own Resource types, beside that service's adapters,
+ * so this registry stays a list of services. A Resource no service claims
+ * falls through to the default adapter, which answers a Ref with the logical
+ * ID.
  */
 export function simCfnResourceValueAdapter(properties) {
-    if (properties.type === "AWS::CertificateManager::Certificate" &&
-        properties.simResource instanceof SimAcmCertificate) {
-        return new SimAcmCertificateCfn({
-            certificate: properties.simResource,
-        });
-    }
-    if (properties.type === "AWS::S3::Bucket" &&
-        properties.simResource instanceof SimS3Bucket) {
-        return new SimS3BucketCfn({
-            bucket: properties.simResource,
-        });
-    }
-    if (properties.type === "AWS::CloudFront::Distribution" &&
-        properties.simResource instanceof SimCloudFrontDistribution) {
-        return new SimCloudFrontDistributionCfn({
-            distro: properties.simResource,
-        });
-    }
-    if (properties.type === "AWS::CloudFront::Function" &&
-        properties.simResource instanceof SimCloudFrontFunction) {
-        return new SimCloudFrontFunctionCfn({
-            cloudFrontFunction: properties.simResource,
-        });
-    }
-    if (properties.type === "AWS::IAM::ManagedPolicy") {
-        return new SimIamManagedPolicyCfn({
-            policy: properties.simResource,
-        });
-    }
-    if (properties.type === "AWS::IAM::Role") {
-        return new SimIamRoleCfn({
-            role: properties.simResource,
-        });
-    }
-    if (properties.type === "AWS::Lambda::Function" &&
-        properties.simResource instanceof SimLambdaFunction) {
-        return new SimLambdaFunctionCfn({
-            lambdaFunction: properties.simResource,
-        });
-    }
-    if (properties.type === "AWS::Lambda::Url" &&
-        properties.simResource instanceof SimLambdaFunctionUrl) {
-        return new SimLambdaFunctionUrlCfn({
-            functionUrl: properties.simResource,
-        });
-    }
-    if (properties.type === "AWS::Route53::HostedZone" &&
-        properties.simResource instanceof SimRoute53HostedZone) {
-        return new SimRoute53HostedZoneCfn({
-            hostedZone: properties.simResource,
-        });
-    }
-    return new SimCfnDefaultResourceValueAdapter({
-        logicalId: properties.logicalId,
-    });
+    return (acmValueAdapter(properties) ??
+        cloudFrontValueAdapter(properties) ??
+        iamValueAdapter(properties) ??
+        kmsValueAdapter(properties) ??
+        lambdaValueAdapter(properties) ??
+        route53ValueAdapter(properties) ??
+        s3ValueAdapter(properties) ??
+        secretsManagerValueAdapter(properties) ??
+        new SimCfnDefaultResourceValueAdapter({
+            logicalId: properties.logicalId,
+        }));
 }
 //# sourceMappingURL=sim-cfn-resource-value-adapter.js.map

package/dist/service/cloudformation/resource/cfn/sim-cfn-resource-value-adapter.js.map

@@ -1 +1 @@
-{"version":3,"file":"sim-cfn-resource-value-adapter.js","sourceRoot":"","sources":["../../../../../src/service/cloudformation/resource/cfn/sim-cfn-resource-value-adapter.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,WAAW,EAAE,MAAM,qCAAqC,CAAC;AAClE,OAAO,EAAE,cAAc,EAAE,MAAM,2BAA2B,CAAC;AAC3D,OAAO,EAAE,iCAAiC,EAAE,MAAM,6CAA6C,CAAC;AAChG,OAAO,EAAE,yBAAyB,EAAE,MAAM,iEAAiE,CAAC;AAC5G,OAAO,EAAE,4BAA4B,EAAE,MAAM,iDAAiD,CAAC;AAC/F,OAAO,EAAE,qBAAqB,EAAE,MAAM,oDAAoD,CAAC;AAC3F,OAAO,EAAE,wBAAwB,EAAE,MAAM,6CAA6C,CAAC;AACvF,OAAO,EAAE,oBAAoB,EAAE,MAAM,yDAAyD,CAAC;AAC/F,OAAO,EAAE,uBAAuB,EAAE,MAAM,0CAA0C,CAAC;AACnF,OAAO,EAAE,oBAAoB,EAAE,MAAM,kCAAkC,CAAC;AACxE,OAAO,EAAE,iBAAiB,EAAE,MAAM,iDAAiD,CAAC;AACpF,OAAO,EAAE,sBAAsB,EAAE,MAAM,qCAAqC,CAAC;AAE7E,OAAO,EAAE,aAAa,EAAE,MAAM,2BAA2B,CAAC;AAE1D,OAAO,EAAE,iBAAiB,EAAE,MAAM,iDAAiD,CAAC;AACpF,OAAO,EAAE,oBAAoB,EAAE,MAAM,qCAAqC,CAAC;AAC3E,OAAO,EAAE,oBAAoB,EAAE,MAAM,yDAAyD,CAAC;AAC/F,OAAO,EAAE,uBAAuB,EAAE,MAAM,yCAAyC,CAAC;AAclF;;;;;;GAMG;AACH,MAAM,UAAU,0BAA0B,CACxC,UAAgD;IAEhD,IACE,UAAU,CAAC,IAAI,KAAK,sCAAsC;QAC1D,UAAU,CAAC,WAAW,YAAY,iBAAiB,EACnD,CAAC;QACD,OAAO,IAAI,oBAAoB,CAAC;YAC9B,WAAW,EAAE,UAAU,CAAC,WAAW;SACpC,CAAC,CAAC;IACL,CAAC;IAED,IACE,UAAU,CAAC,IAAI,KAAK,iBAAiB;QACrC,UAAU,CAAC,WAAW,YAAY,WAAW,EAC7C,CAAC;QACD,OAAO,IAAI,cAAc,CAAC;YACxB,MAAM,EAAE,UAAU,CAAC,WAAW;SAC/B,CAAC,CAAC;IACL,CAAC;IAED,IACE,UAAU,CAAC,IAAI,KAAK,+BAA+B;QACnD,UAAU,CAAC,WAAW,YAAY,yBAAyB,EAC3D,CAAC;QACD,OAAO,IAAI,4BAA4B,CAAC;YACtC,MAAM,EAAE,UAAU,CAAC,WAAW;SAC/B,CAAC,CAAC;IACL,CAAC;IAED,IACE,UAAU,CAAC,IAAI,KAAK,2BAA2B;QAC/C,UAAU,CAAC,WAAW,YAAY,qBAAqB,EACvD,CAAC;QACD,OAAO,IAAI,wBAAwB,CAAC;YAClC,kBAAkB,EAAE,UAAU,CAAC,WAAW;SAC3C,CAAC,CAAC;IACL,CAAC;IAED,IAAI,UAAU,CAAC,IAAI,KAAK,yBAAyB,EAAE,CAAC;QAClD,OAAO,IAAI,sBAAsB,CAAC;YAChC,MAAM,EAAE,UAAU,CAAC,WAAkC;SACtD,CAAC,CAAC;IACL,CAAC;IAED,IAAI,UAAU,CAAC,IAAI,KAAK,gBAAgB,EAAE,CAAC;QACzC,OAAO,IAAI,aAAa,CAAC;YACvB,IAAI,EAAE,UAAU,CAAC,WAAyB;SAC3C,CAAC,CAAC;IACL,CAAC;IAED,IACE,UAAU,CAAC,IAAI,KAAK,uBAAuB;QAC3C,UAAU,CAAC,WAAW,YAAY,iBAAiB,EACnD,CAAC;QACD,OAAO,IAAI,oBAAoB,CAAC;YAC9B,cAAc,EAAE,UAAU,CAAC,WAAW;SACvC,CAAC,CAAC;IACL,CAAC;IAED,IACE,UAAU,CAAC,IAAI,KAAK,kBAAkB;QACtC,UAAU,CAAC,WAAW,YAAY,oBAAoB,EACtD,CAAC;QACD,OAAO,IAAI,uBAAuB,CAAC;YACjC,WAAW,EAAE,UAAU,CAAC,WAAW;SACpC,CAAC,CAAC;IACL,CAAC;IAED,IACE,UAAU,CAAC,IAAI,KAAK,0BAA0B;QAC9C,UAAU,CAAC,WAAW,YAAY,oBAAoB,EACtD,CAAC;QACD,OAAO,IAAI,uBAAuB,CAAC;YACjC,UAAU,EAAE,UAAU,CAAC,WAAW;SACnC,CAAC,CAAC;IACL,CAAC;IAED,OAAO,IAAI,iCAAiC,CAAC;QAC3C,SAAS,EAAE,UAAU,CAAC,SAAS;KAChC,CAAC,CAAC;AACL,CAAC"}
+{"version":3,"file":"sim-cfn-resource-value-adapter.js","sourceRoot":"","sources":["../../../../../src/service/cloudformation/resource/cfn/sim-cfn-resource-value-adapter.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,eAAe,EAAE,MAAM,oCAAoC,CAAC;AACrE,OAAO,EAAE,sBAAsB,EAAE,MAAM,kDAAkD,CAAC;AAC1F,OAAO,EAAE,eAAe,EAAE,MAAM,oCAAoC,CAAC;AACrE,OAAO,EAAE,eAAe,EAAE,MAAM,oCAAoC,CAAC;AACrE,OAAO,EAAE,kBAAkB,EAAE,MAAM,0CAA0C,CAAC;AAC9E,OAAO,EAAE,mBAAmB,EAAE,MAAM,4CAA4C,CAAC;AACjF,OAAO,EAAE,cAAc,EAAE,MAAM,kCAAkC,CAAC;AAClE,OAAO,EAAE,0BAA0B,EAAE,MAAM,2DAA2D,CAAC;AACvG,OAAO,EAAE,iCAAiC,EAAE,MAAM,6CAA6C,CAAC;AAoBhG;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,0BAA0B,CACxC,UAAgD;IAEhD,OAAO,CACL,eAAe,CAAC,UAAU,CAAC;QAC3B,sBAAsB,CAAC,UAAU,CAAC;QAClC,eAAe,CAAC,UAAU,CAAC;QAC3B,eAAe,CAAC,UAAU,CAAC;QAC3B,kBAAkB,CAAC,UAAU,CAAC;QAC9B,mBAAmB,CAAC,UAAU,CAAC;QAC/B,cAAc,CAAC,UAAU,CAAC;QAC1B,0BAA0B,CAAC,UAAU,CAAC;QACtC,IAAI,iCAAiC,CAAC;YACpC,SAAS,EAAE,UAAU,CAAC,SAAS;SAChC,CAAC,CACH,CAAC;AACJ,CAAC"}

package/dist/service/cloudformation/resource/dependency/sim-cfn-resource-dependencies.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"sim-cfn-resource-dependencies.d.ts","sourceRoot":"","sources":["../../../../../src/service/cloudformation/resource/dependency/sim-cfn-resource-dependencies.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,gDAAgD,CAAC;AAGhG;;GAEG;AACH,wBAAgB,+BAA+B,CAAC,SAAS,EAAE,OAAO,GAAG,MAAM,EAAE,CAY5E;AAED;;;;;;GAMG;AACH,wBAAgB,kCAAkC,CAChD,QAAQ,EAAE,yBAAyB,EACnC,kBAAkB,EAAE,WAAW,CAAC,MAAM,CAAC,GACtC,MAAM,EAAE,CAMV"}
+{"version":3,"file":"sim-cfn-resource-dependencies.d.ts","sourceRoot":"","sources":["../../../../../src/service/cloudformation/resource/dependency/sim-cfn-resource-dependencies.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,gDAAgD,CAAC;AAGhG;;GAEG;AACH,wBAAgB,+BAA+B,CAAC,SAAS,EAAE,OAAO,GAAG,MAAM,EAAE,CAY5E;AAED;;;;;;GAMG;AACH,wBAAgB,kCAAkC,CAChD,QAAQ,EAAE,yBAAyB,EACnC,kBAAkB,EAAE,WAAW,CAAC,MAAM,CAAC,GACtC,MAAM,EAAE,CAIV"}

package/dist/service/cloudformation/resource/dependency/sim-cfn-resource-dependencies.js

@@ -22,6 +22,6 @@ export function parseSimCfnResourceDependencies(dependsOn) {
  */
 export function parseSimCfnResourceRefDependencies(template, resourceLogicalIds) {
     const referencedNames = parseSimCfnNode(template).referencedNames();
-    return [...new Set(referencedNames)].filter((name) => resourceLogicalIds.has(name));
+    return [...new Set(referencedNames).intersection(resourceLogicalIds)];
 }
 //# sourceMappingURL=sim-cfn-resource-dependencies.js.map

package/dist/service/cloudformation/resource/dependency/sim-cfn-resource-dependencies.js.map

@@ -1 +1 @@
-{"version":3,"file":"sim-cfn-resource-dependencies.js","sourceRoot":"","sources":["../../../../../src/service/cloudformation/resource/dependency/sim-cfn-resource-dependencies.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,eAAe,EAAE,MAAM,kDAAkD,CAAC;AAEnF;;GAEG;AACH,MAAM,UAAU,+BAA+B,CAAC,SAAkB;IAChE,IAAI,OAAO,SAAS,KAAK,QAAQ,EAAE,CAAC;QAClC,OAAO,CAAC,SAAS,CAAC,CAAC;IACrB,CAAC;IAED,IAAI,KAAK,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,CAAC;QAC7B,OAAO,SAAS,CAAC,MAAM,CAAC,CAAC,UAAU,EAAwB,EAAE;YAC3D,OAAO,OAAO,UAAU,KAAK,QAAQ,CAAC;QACxC,CAAC,CAAC,CAAC;IACL,CAAC;IAED,OAAO,EAAE,CAAC;AACZ,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,kCAAkC,CAChD,QAAmC,EACnC,kBAAuC;IAEvC,MAAM,eAAe,GAAG,eAAe,CAAC,QAAQ,CAAC,CAAC,eAAe,EAAE,CAAC;IAEpE,OAAO,CAAC,GAAG,IAAI,GAAG,CAAC,eAAe,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CACnD,kBAAkB,CAAC,GAAG,CAAC,IAAI,CAAC,CAC7B,CAAC;AACJ,CAAC"}
+{"version":3,"file":"sim-cfn-resource-dependencies.js","sourceRoot":"","sources":["../../../../../src/service/cloudformation/resource/dependency/sim-cfn-resource-dependencies.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,eAAe,EAAE,MAAM,kDAAkD,CAAC;AAEnF;;GAEG;AACH,MAAM,UAAU,+BAA+B,CAAC,SAAkB;IAChE,IAAI,OAAO,SAAS,KAAK,QAAQ,EAAE,CAAC;QAClC,OAAO,CAAC,SAAS,CAAC,CAAC;IACrB,CAAC;IAED,IAAI,KAAK,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,CAAC;QAC7B,OAAO,SAAS,CAAC,MAAM,CAAC,CAAC,UAAU,EAAwB,EAAE;YAC3D,OAAO,OAAO,UAAU,KAAK,QAAQ,CAAC;QACxC,CAAC,CAAC,CAAC;IACL,CAAC;IAED,OAAO,EAAE,CAAC;AACZ,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,kCAAkC,CAChD,QAAmC,EACnC,kBAAuC;IAEvC,MAAM,eAAe,GAAG,eAAe,CAAC,QAAQ,CAAC,CAAC,eAAe,EAAE,CAAC;IAEpE,OAAO,CAAC,GAAG,IAAI,GAAG,CAAC,eAAe,CAAC,CAAC,YAAY,CAAC,kBAAkB,CAAC,CAAC,CAAC;AACxE,CAAC"}

package/dist/service/cloudformation/resource/resolve/service/sim-cfn-service-resolver.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"sim-cfn-service-resolver.d.ts","sourceRoot":"","sources":["../../../../../../src/service/cloudformation/resource/resolve/service/sim-cfn-service-resolver.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,4BAA4B,CAAC;AACzD,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,iDAAiD,CAAC;AAChG,OAAO,KAAK,EACV,mCAAmC,EACnC,4BAA4B,EAC7B,MAAM,gDAAgD,CAAC;AAIxD;;GAEG;AACH,wBAAgB,8CAA8C,CAC5D,MAAM,EAAE,MAAM,EACd,kBAAkB,EAAE,wBAAwB,EAC5C,YAAY,EAAE,mCAAmC,GAChD,4BAA4B,CAuD9B"}
+{"version":3,"file":"sim-cfn-service-resolver.d.ts","sourceRoot":"","sources":["../../../../../../src/service/cloudformation/resource/resolve/service/sim-cfn-service-resolver.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,4BAA4B,CAAC;AACzD,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,iDAAiD,CAAC;AAChG,OAAO,KAAK,EACV,mCAAmC,EACnC,4BAA4B,EAC7B,MAAM,gDAAgD,CAAC;AAIxD;;GAEG;AACH,wBAAgB,8CAA8C,CAC5D,MAAM,EAAE,MAAM,EACd,kBAAkB,EAAE,wBAAwB,EAC5C,YAAY,EAAE,mCAAmC,GAChD,4BAA4B,CA6D9B"}

package/dist/service/cloudformation/resource/resolve/service/sim-cfn-service-resolver.js

@@ -30,6 +30,9 @@ export function resolveSimCloudFormationServiceResourceFactory(simAws, accountRe
         case "IAM": {
             return scopedAws.iam().cfnResourceFactory();
         }
+        case "KMS": {
+            return scopedAws.kms().cfnResourceFactory();
+        }
         case "Lambda": {
             return scopedAws.lambda().cfnResourceFactory();
         }
@@ -39,6 +42,9 @@ export function resolveSimCloudFormationServiceResourceFactory(simAws, accountRe
         case "S3": {
             return scopedAws.s3().cfnResourceFactory();
         }
+        case "SecretsManager": {
+            return scopedAws.secretsManager().cfnResourceFactory();
+        }
         default: {
             throw new Error(`Unsupported sim CloudFormation Resource service ${resourceType.serviceName}`);
         }

package/dist/service/cloudformation/resource/resolve/service/sim-cfn-service-resolver.js.map

@@ -1 +1 @@
-{"version":3,"file":"sim-cfn-service-resolver.js","sourceRoot":"","sources":["../../../../../../src/service/cloudformation/resource/resolve/service/sim-cfn-service-resolver.ts"],"names":[],"mappings":"AAMA,OAAO,EAAE,wBAAwB,EAAE,MAAM,+CAA+C,CAAC;AACzF,OAAO,EAAE,qCAAqC,EAAE,MAAM,gEAAgE,CAAC;AAEvH;;GAEG;AACH,MAAM,UAAU,8CAA8C,CAC5D,MAAc,EACd,kBAA4C,EAC5C,YAAiD;IAEjD,IACE,YAAY,CAAC,YAAY,KAAK,QAAQ;QACtC,YAAY,CAAC,WAAW,KAAK,QAAQ;QACrC,YAAY,CAAC,gBAAgB,KAAK,qBAAqB,EACvD,CAAC;QACD,OAAO,IAAI,qCAAqC,EAAE,CAAC;IACrD,CAAC;IAED,IAAI,YAAY,CAAC,YAAY,KAAK,QAAQ,EAAE,CAAC;QAC3C,MAAM,IAAI,KAAK,CACb,kDAAkD,YAAY,CAAC,gBAAgB,EAAE,CAClF,CAAC;IACJ,CAAC;IAED,IAAI,YAAY,CAAC,YAAY,KAAK,KAAK,EAAE,CAAC;QACxC,MAAM,IAAI,KAAK,CACb,oDAAoD,YAAY,CAAC,YAAY,EAAE,CAChF,CAAC;IACJ,CAAC;IAED,MAAM,SAAS,GAAG,MAAM,CAAC,kBAAkB,CACzC,kBAAkB,CAAC,SAAS,EAC5B,kBAAkB,CAAC,UAAU,CAC9B,CAAC;IAEF,QAAQ,YAAY,CAAC,WAAW,EAAE,CAAC;QACjC,KAAK,KAAK,CAAC;QACX,KAAK,oBAAoB,EAAE,CAAC;YAC1B,OAAO,SAAS,CAAC,GAAG,EAAE,CAAC,kBAAkB,EAAE,CAAC;QAC9C,CAAC;QACD,KAAK,gBAAgB,EAAE,CAAC;YACtB,OAAO,IAAI,wBAAwB,EAAE,CAAC;QACxC,CAAC;QACD,KAAK,YAAY,EAAE,CAAC;YAClB,OAAO,SAAS,CAAC,UAAU,EAAE,CAAC,kBAAkB,EAAE,CAAC;QACrD,CAAC;QACD,KAAK,KAAK,EAAE,CAAC;YACX,OAAO,SAAS,CAAC,GAAG,EAAE,CAAC,kBAAkB,EAAE,CAAC;QAC9C,CAAC;QACD,KAAK,QAAQ,EAAE,CAAC;YACd,OAAO,SAAS,CAAC,MAAM,EAAE,CAAC,kBAAkB,EAAE,CAAC;QACjD,CAAC;QACD,KAAK,SAAS,EAAE,CAAC;YACf,OAAO,SAAS,CAAC,OAAO,EAAE,CAAC,kBAAkB,EAAE,CAAC;QAClD,CAAC;QACD,KAAK,IAAI,EAAE,CAAC;YACV,OAAO,SAAS,CAAC,EAAE,EAAE,CAAC,kBAAkB,EAAE,CAAC;QAC7C,CAAC;QACD,SAAS,CAAC;YACR,MAAM,IAAI,KAAK,CACb,mDAAmD,YAAY,CAAC,WAAW,EAAE,CAC9E,CAAC;QACJ,CAAC;IACH,CAAC;AACH,CAAC"}
+{"version":3,"file":"sim-cfn-service-resolver.js","sourceRoot":"","sources":["../../../../../../src/service/cloudformation/resource/resolve/service/sim-cfn-service-resolver.ts"],"names":[],"mappings":"AAMA,OAAO,EAAE,wBAAwB,EAAE,MAAM,+CAA+C,CAAC;AACzF,OAAO,EAAE,qCAAqC,EAAE,MAAM,gEAAgE,CAAC;AAEvH;;GAEG;AACH,MAAM,UAAU,8CAA8C,CAC5D,MAAc,EACd,kBAA4C,EAC5C,YAAiD;IAEjD,IACE,YAAY,CAAC,YAAY,KAAK,QAAQ;QACtC,YAAY,CAAC,WAAW,KAAK,QAAQ;QACrC,YAAY,CAAC,gBAAgB,KAAK,qBAAqB,EACvD,CAAC;QACD,OAAO,IAAI,qCAAqC,EAAE,CAAC;IACrD,CAAC;IAED,IAAI,YAAY,CAAC,YAAY,KAAK,QAAQ,EAAE,CAAC;QAC3C,MAAM,IAAI,KAAK,CACb,kDAAkD,YAAY,CAAC,gBAAgB,EAAE,CAClF,CAAC;IACJ,CAAC;IAED,IAAI,YAAY,CAAC,YAAY,KAAK,KAAK,EAAE,CAAC;QACxC,MAAM,IAAI,KAAK,CACb,oDAAoD,YAAY,CAAC,YAAY,EAAE,CAChF,CAAC;IACJ,CAAC;IAED,MAAM,SAAS,GAAG,MAAM,CAAC,kBAAkB,CACzC,kBAAkB,CAAC,SAAS,EAC5B,kBAAkB,CAAC,UAAU,CAC9B,CAAC;IAEF,QAAQ,YAAY,CAAC,WAAW,EAAE,CAAC;QACjC,KAAK,KAAK,CAAC;QACX,KAAK,oBAAoB,EAAE,CAAC;YAC1B,OAAO,SAAS,CAAC,GAAG,EAAE,CAAC,kBAAkB,EAAE,CAAC;QAC9C,CAAC;QACD,KAAK,gBAAgB,EAAE,CAAC;YACtB,OAAO,IAAI,wBAAwB,EAAE,CAAC;QACxC,CAAC;QACD,KAAK,YAAY,EAAE,CAAC;YAClB,OAAO,SAAS,CAAC,UAAU,EAAE,CAAC,kBAAkB,EAAE,CAAC;QACrD,CAAC;QACD,KAAK,KAAK,EAAE,CAAC;YACX,OAAO,SAAS,CAAC,GAAG,EAAE,CAAC,kBAAkB,EAAE,CAAC;QAC9C,CAAC;QACD,KAAK,KAAK,EAAE,CAAC;YACX,OAAO,SAAS,CAAC,GAAG,EAAE,CAAC,kBAAkB,EAAE,CAAC;QAC9C,CAAC;QACD,KAAK,QAAQ,EAAE,CAAC;YACd,OAAO,SAAS,CAAC,MAAM,EAAE,CAAC,kBAAkB,EAAE,CAAC;QACjD,CAAC;QACD,KAAK,SAAS,EAAE,CAAC;YACf,OAAO,SAAS,CAAC,OAAO,EAAE,CAAC,kBAAkB,EAAE,CAAC;QAClD,CAAC;QACD,KAAK,IAAI,EAAE,CAAC;YACV,OAAO,SAAS,CAAC,EAAE,EAAE,CAAC,kBAAkB,EAAE,CAAC;QAC7C,CAAC;QACD,KAAK,gBAAgB,EAAE,CAAC;YACtB,OAAO,SAAS,CAAC,cAAc,EAAE,CAAC,kBAAkB,EAAE,CAAC;QACzD,CAAC;QACD,SAAS,CAAC;YACR,MAAM,IAAI,KAAK,CACb,mDAAmD,YAAY,CAAC,WAAW,EAAE,CAC9E,CAAC;QACJ,CAAC;IACH,CAAC;AACH,CAAC"}

package/dist/service/cloudfront/controller/dependency/sim-cf-controller-dependency.js

@@ -12,7 +12,7 @@ export class SimCloudFrontControllerDependenciesFactory {
      */
     make(properties = {}) {
         const simAws = properties.simAws ?? new SimAws();
-        const cloudFrontRegistry = properties.cloudFrontRegistry ?? simAws.cloudFrontRegistry();
+        const cloudFrontRegistry = properties.cloudFrontRegistry ?? simAws.serviceFactory.cloudFrontRegistry;
         return {
             distroRouter: properties.distroRouter ??
                 new DefaultSimCloudFrontDistroRouter({

package/dist/service/cloudfront/controller/dependency/sim-cf-controller-dependency.js.map

@@ -1 +1 @@
-{"version":3,"file":"sim-cf-controller-dependency.js","sourceRoot":"","sources":["../../../../../src/service/cloudfront/controller/dependency/sim-cf-controller-dependency.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,MAAM,yBAAyB,CAAC;AAGjD,OAAO,EAAE,yBAAyB,IAAI,gCAAgC,EAAE,MAAM,+CAA+C,CAAC;AAE9H,OAAO,EAAE,6BAA6B,IAAI,oCAAoC,EAAE,MAAM,qDAAqD,CAAC;AAC5I,OAAO,EAAE,gBAAgB,EAAE,MAAM,8BAA8B,CAAC;AAChE,OAAO,EAAE,0BAA0B,EAAE,MAAM,4CAA4C,CAAC;AAkBxF;;GAEG;AACH,MAAM,OAAO,0CAA0C;IACrD;;OAEG;IACH,IAAI,CACF,UAAU,GAA6C,EAAE;QAEzD,MAAM,MAAM,GAAG,UAAU,CAAC,MAAM,IAAI,IAAI,MAAM,EAAE,CAAC;QACjD,MAAM,kBAAkB,GACtB,UAAU,CAAC,kBAAkB,IAAI,MAAM,CAAC,kBAAkB,EAAE,CAAC;QAE/D,OAAO;YACL,YAAY,EACV,UAAU,CAAC,YAAY;gBACvB,IAAI,gCAAgC,CAAC;oBACnC,MAAM;oBACN,kBAAkB;iBACnB,CAAC;YACJ,iBAAiB,EACf,UAAU,CAAC,iBAAiB;gBAC5B,IAAI,oCAAoC,EAAE;YAC5C,aAAa,EAAE,UAAU,CAAC,aAAa,IAAI,IAAI,gBAAgB,EAAE;YACjE,aAAa,EACX,UAAU,CAAC,aAAa,IAAI,IAAI,0BAA0B,EAAE;SAC/D,CAAC;IACJ,CAAC;CACF"}
+{"version":3,"file":"sim-cf-controller-dependency.js","sourceRoot":"","sources":["../../../../../src/service/cloudfront/controller/dependency/sim-cf-controller-dependency.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,MAAM,yBAAyB,CAAC;AAGjD,OAAO,EAAE,yBAAyB,IAAI,gCAAgC,EAAE,MAAM,+CAA+C,CAAC;AAE9H,OAAO,EAAE,6BAA6B,IAAI,oCAAoC,EAAE,MAAM,qDAAqD,CAAC;AAC5I,OAAO,EAAE,gBAAgB,EAAE,MAAM,8BAA8B,CAAC;AAChE,OAAO,EAAE,0BAA0B,EAAE,MAAM,4CAA4C,CAAC;AAkBxF;;GAEG;AACH,MAAM,OAAO,0CAA0C;IACrD;;OAEG;IACH,IAAI,CACF,UAAU,GAA6C,EAAE;QAEzD,MAAM,MAAM,GAAG,UAAU,CAAC,MAAM,IAAI,IAAI,MAAM,EAAE,CAAC;QACjD,MAAM,kBAAkB,GACtB,UAAU,CAAC,kBAAkB,IAAI,MAAM,CAAC,cAAc,CAAC,kBAAkB,CAAC;QAE5E,OAAO;YACL,YAAY,EACV,UAAU,CAAC,YAAY;gBACvB,IAAI,gCAAgC,CAAC;oBACnC,MAAM;oBACN,kBAAkB;iBACnB,CAAC;YACJ,iBAAiB,EACf,UAAU,CAAC,iBAAiB;gBAC5B,IAAI,oCAAoC,EAAE;YAC5C,aAAa,EAAE,UAAU,CAAC,aAAa,IAAI,IAAI,gBAAgB,EAAE;YACjE,aAAa,EACX,UAAU,CAAC,aAAa,IAAI,IAAI,0BAA0B,EAAE;SAC/D,CAAC;IACJ,CAAC;CACF"}

package/dist/service/cloudfront/router/sim-cloud-front-distro-router.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"sim-cloud-front-distro-router.d.ts","sourceRoot":"","sources":["../../../../src/service/cloudfront/router/sim-cloud-front-distro-router.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACV,yBAAyB,EACzB,2BAA2B,EAC5B,MAAM,gDAAgD,CAAC;AAGxD,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAC;AAC1D,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,yCAAyC,CAAC;AACrF,OAAO,EAAE,MAAM,EAAE,MAAM,sBAAsB,CAAC;AAK9C,MAAM,WAAW,wBAAwB;IACvC,QAAQ,CAAC,UAAU,EAAE,aAAa,CAAC;IACnC,QAAQ,CAAC,YAAY,EAAE,yBAAyB,CAAC;CAClD;AAED,UAAU,mCAAmC;IAC3C,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,kBAAkB,CAAC,EAAE,qBAAqB,CAAC;IACpD,QAAQ,CAAC,aAAa,CAAC,EAAE,WAAW,CAClC,2BAA2B,EAC3B,yBAAyB,CAC1B,CAAC;CACH;AAED;;;;;;;GAOG;AACH,qBAAa,yBAAyB;IACpC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAS;IAChC,OAAO,CAAC,QAAQ,CAAC,qBAAqB,CAAqC;IAC3E,OAAO,CAAC,QAAQ,CAAC,cAAc,CAA8B;IAE7D,YAAY,UAAU,GAAE,mCAAwC,EAkB/D;IAED;;OAEG;IACH,MAAM,CAAC,iBAAiB,CACtB,aAAa,EAAE,yBAAyB,EAAE,GACzC,yBAAyB,CAM3B;IAED;;;;;;OAMG;IACH,eAAe,CAAC,OAAO,EAAE,OAAO,GAAG,wBAAwB,GAAG,SAAS,CAatE;IAED;;OAEG;IACH,gBAAgB,CAAC,OAAO,EAAE,OAAO,GAAG,yBAAyB,GAAG,SAAS,CAExE;CACF"}
+{"version":3,"file":"sim-cloud-front-distro-router.d.ts","sourceRoot":"","sources":["../../../../src/service/cloudfront/router/sim-cloud-front-distro-router.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACV,yBAAyB,EACzB,2BAA2B,EAC5B,MAAM,gDAAgD,CAAC;AAGxD,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAC;AAC1D,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,yCAAyC,CAAC;AACrF,OAAO,EAAE,MAAM,EAAE,MAAM,sBAAsB,CAAC;AAK9C,MAAM,WAAW,wBAAwB;IACvC,QAAQ,CAAC,UAAU,EAAE,aAAa,CAAC;IACnC,QAAQ,CAAC,YAAY,EAAE,yBAAyB,CAAC;CAClD;AAED,UAAU,mCAAmC;IAC3C,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,kBAAkB,CAAC,EAAE,qBAAqB,CAAC;IACpD,QAAQ,CAAC,aAAa,CAAC,EAAE,WAAW,CAClC,2BAA2B,EAC3B,yBAAyB,CAC1B,CAAC;CACH;AAED;;;;;;;GAOG;AACH,qBAAa,yBAAyB;IACpC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAS;IAChC,OAAO,CAAC,QAAQ,CAAC,qBAAqB,CAAqC;IAC3E,OAAO,CAAC,QAAQ,CAAC,cAAc,CAA8B;IAE7D,YAAY,UAAU,GAAE,mCAAwC,EAmB/D;IAED;;OAEG;IACH,MAAM,CAAC,iBAAiB,CACtB,aAAa,EAAE,yBAAyB,EAAE,GACzC,yBAAyB,CAM3B;IAED;;;;;;OAMG;IACH,eAAe,CAAC,OAAO,EAAE,OAAO,GAAG,wBAAwB,GAAG,SAAS,CAatE;IAED;;OAEG;IACH,gBAAgB,CAAC,OAAO,EAAE,OAAO,GAAG,yBAAyB,GAAG,SAAS,CAExE;CACF"}

package/dist/service/cloudfront/router/sim-cloud-front-distro-router.js

@@ -18,7 +18,8 @@ export class SimCloudFrontDistroRouter {
     distroIdRouter;
     constructor(properties = {}) {
         this.simAws = properties.simAws ?? new SimAws();
-        const cloudFrontRegistry = properties.cloudFrontRegistry ?? this.simAws.cloudFrontRegistry();
+        const cloudFrontRegistry = properties.cloudFrontRegistry ??
+            this.simAws.serviceFactory.cloudFrontRegistry;
         const distributions = properties.distributions ?? new Map();
         // Both sub-routers share the same SimAws, Registry and Distributions
         // snapshot so their lookups stay consistent within a single request.

package/dist/service/cloudfront/router/sim-cloud-front-distro-router.js.map

@@ -1 +1 @@
-{"version":3,"file":"sim-cloud-front-distro-router.js","sourceRoot":"","sources":["../../../../src/service/cloudfront/router/sim-cloud-front-distro-router.ts"],"names":[],"mappings":"AAIA,OAAO,EAAE,aAAa,EAAE,MAAM,qCAAqC,CAAC;AACpE,OAAO,EAAE,cAAc,EAAE,MAAM,8CAA8C,CAAC;AAG9E,OAAO,EAAE,MAAM,EAAE,MAAM,sBAAsB,CAAC;AAC9C,OAAO,EAAE,6BAA6B,EAAE,MAAM,0CAA0C,CAAC;AACzF,OAAO,EAAE,kCAAkC,EAAE,MAAM,sDAAsD,CAAC;AAC1G,OAAO,EAAE,2BAA2B,EAAE,MAAM,wCAAwC,CAAC;AAgBrF;;;;;;;GAOG;AACH,MAAM,OAAO,yBAAyB;IACnB,MAAM,CAAS;IACf,qBAAqB,CAAqC;IAC1D,cAAc,CAA8B;IAE7D,YAAY,UAAU,GAAwC,EAAE;QAC9D,IAAI,CAAC,MAAM,GAAG,UAAU,CAAC,MAAM,IAAI,IAAI,MAAM,EAAE,CAAC;QAChD,MAAM,kBAAkB,GACtB,UAAU,CAAC,kBAAkB,IAAI,IAAI,CAAC,MAAM,CAAC,kBAAkB,EAAE,CAAC;QACpE,MAAM,aAAa,GAAG,UAAU,CAAC,aAAa,IAAI,IAAI,GAAG,EAAE,CAAC;QAE5D,qEAAqE;QACrE,qEAAqE;QACrE,IAAI,CAAC,qBAAqB,GAAG,IAAI,kCAAkC,CAAC;YAClE,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,kBAAkB;YAClB,aAAa;SACd,CAAC,CAAC;QACH,IAAI,CAAC,cAAc,GAAG,IAAI,2BAA2B,CAAC;YACpD,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,kBAAkB;YAClB,aAAa;SACd,CAAC,CAAC;IACL,CAAC;IAED;;OAEG;IACH,MAAM,CAAC,iBAAiB,CACtB,aAA0C;QAE1C,OAAO,IAAI,yBAAyB,CAAC;YACnC,aAAa,EAAE,IAAI,GAAG,CACpB,aAAa,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,MAAM,CAAC,cAAc,EAAE,MAAM,CAAC,CAAC,CAC/D;SACF,CAAC,CAAC;IACL,CAAC;IAED;;;;;;OAMG;IACH,eAAe,CAAC,OAAgB;QAC9B,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QACjC,MAAM,QAAQ,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,GAAG,CAAC,QAAQ,CAAC;QAC7D,aAAa,CAAC,QAAQ,EAAE,mCAAmC,CAAC,CAAC;QAC7D,MAAM,MAAM,GAAG,IAAI,cAAc,CAAC,EAAE,KAAK,EAAE,UAAU,QAAQ,GAAG,EAAE,CAAC,CAAC;QACpE,MAAM,YAAY,GAAG,MAAM,CAAC,sBAAsB,EAAE,CAAC,QAAQ,CAAC;QAE9D,MAAM,cAAc,GAAG,6BAA6B,CAAC,YAAY,CAAC,CAAC;QACnE,IAAI,cAAc,KAAK,SAAS,EAAE,CAAC;YACjC,OAAO,IAAI,CAAC,cAAc,CAAC,sBAAsB,CAAC,cAAc,CAAC,CAAC;QACpE,CAAC;QAED,OAAO,IAAI,CAAC,qBAAqB,CAAC,2BAA2B,CAAC,YAAY,CAAC,CAAC;IAC9E,CAAC;IAED;;OAEG;IACH,gBAAgB,CAAC,OAAgB;QAC/B,OAAO,IAAI,CAAC,eAAe,CAAC,OAAO,CAAC,EAAE,YAAY,CAAC;IACrD,CAAC;CACF"}
+{"version":3,"file":"sim-cloud-front-distro-router.js","sourceRoot":"","sources":["../../../../src/service/cloudfront/router/sim-cloud-front-distro-router.ts"],"names":[],"mappings":"AAIA,OAAO,EAAE,aAAa,EAAE,MAAM,qCAAqC,CAAC;AACpE,OAAO,EAAE,cAAc,EAAE,MAAM,8CAA8C,CAAC;AAG9E,OAAO,EAAE,MAAM,EAAE,MAAM,sBAAsB,CAAC;AAC9C,OAAO,EAAE,6BAA6B,EAAE,MAAM,0CAA0C,CAAC;AACzF,OAAO,EAAE,kCAAkC,EAAE,MAAM,sDAAsD,CAAC;AAC1G,OAAO,EAAE,2BAA2B,EAAE,MAAM,wCAAwC,CAAC;AAgBrF;;;;;;;GAOG;AACH,MAAM,OAAO,yBAAyB;IACnB,MAAM,CAAS;IACf,qBAAqB,CAAqC;IAC1D,cAAc,CAA8B;IAE7D,YAAY,UAAU,GAAwC,EAAE;QAC9D,IAAI,CAAC,MAAM,GAAG,UAAU,CAAC,MAAM,IAAI,IAAI,MAAM,EAAE,CAAC;QAChD,MAAM,kBAAkB,GACtB,UAAU,CAAC,kBAAkB;YAC7B,IAAI,CAAC,MAAM,CAAC,cAAc,CAAC,kBAAkB,CAAC;QAChD,MAAM,aAAa,GAAG,UAAU,CAAC,aAAa,IAAI,IAAI,GAAG,EAAE,CAAC;QAE5D,qEAAqE;QACrE,qEAAqE;QACrE,IAAI,CAAC,qBAAqB,GAAG,IAAI,kCAAkC,CAAC;YAClE,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,kBAAkB;YAClB,aAAa;SACd,CAAC,CAAC;QACH,IAAI,CAAC,cAAc,GAAG,IAAI,2BAA2B,CAAC;YACpD,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,kBAAkB;YAClB,aAAa;SACd,CAAC,CAAC;IACL,CAAC;IAED;;OAEG;IACH,MAAM,CAAC,iBAAiB,CACtB,aAA0C;QAE1C,OAAO,IAAI,yBAAyB,CAAC;YACnC,aAAa,EAAE,IAAI,GAAG,CACpB,aAAa,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,MAAM,CAAC,cAAc,EAAE,MAAM,CAAC,CAAC,CAC/D;SACF,CAAC,CAAC;IACL,CAAC;IAED;;;;;;OAMG;IACH,eAAe,CAAC,OAAgB;QAC9B,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QACjC,MAAM,QAAQ,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,GAAG,CAAC,QAAQ,CAAC;QAC7D,aAAa,CAAC,QAAQ,EAAE,mCAAmC,CAAC,CAAC;QAC7D,MAAM,MAAM,GAAG,IAAI,cAAc,CAAC,EAAE,KAAK,EAAE,UAAU,QAAQ,GAAG,EAAE,CAAC,CAAC;QACpE,MAAM,YAAY,GAAG,MAAM,CAAC,sBAAsB,EAAE,CAAC,QAAQ,CAAC;QAE9D,MAAM,cAAc,GAAG,6BAA6B,CAAC,YAAY,CAAC,CAAC;QACnE,IAAI,cAAc,KAAK,SAAS,EAAE,CAAC;YACjC,OAAO,IAAI,CAAC,cAAc,CAAC,sBAAsB,CAAC,cAAc,CAAC,CAAC;QACpE,CAAC;QAED,OAAO,IAAI,CAAC,qBAAqB,CAAC,2BAA2B,CAAC,YAAY,CAAC,CAAC;IAC9E,CAAC;IAED;;OAEG;IACH,gBAAgB,CAAC,OAAgB;QAC/B,OAAO,IAAI,CAAC,eAAe,CAAC,OAAO,CAAC,EAAE,YAAY,CAAC;IACrD,CAAC;CACF"}

package/dist/service/iam/authorize/allow/sim-iam-allow-requirement.d.ts

@@ -1,6 +1,11 @@
 interface SimIamAllowSidesProperties {
     readonly identity: boolean;
     readonly resource: boolean;
+    /**
+     * Whether a resource-policy Allow named the caller rather than its Account.
+     * Defaults to the resource side, for callers with no reason to distinguish.
+     */
+    readonly resourceDirect?: boolean | undefined;
 }
 /**
  * Which sides of a policy evaluation produced a matching Allow.
@@ -13,6 +18,7 @@ interface SimIamAllowSidesProperties {
 export declare class SimIamAllowSides {
     private readonly identityAllowed;
     private readonly resourceAllowed;
+    private readonly resourceDirectAllowed;
     constructor(properties: SimIamAllowSidesProperties);
     /**
      * Whether an identity-based policy allowed the request.
@@ -22,6 +28,16 @@ export declare class SimIamAllowSides {
      * Whether a resource-based policy allowed the request.
      */
     get resource(): boolean;
+    /**
+     * Whether a resource-based policy allowed the request by naming the caller,
+     * rather than by delegating to the caller's Account.
+     */
+    get resourceDirect(): boolean;
+    /**
+     * Whether the resource's policy admitted the caller only by delegating to
+     * its Account, which grants nothing on its own.
+     */
+    get resourceDelegated(): boolean;
 }
 /**
  * Which sides of an authorization must allow a request for it to be allowed.
@@ -56,5 +72,45 @@ export declare class SimIamBothSidesAllowRequirement implements SimIamAllowRequi
      */
     isSatisfiedBy(allows: SimIamAllowSides): boolean;
 }
+/**
+ * The rule for a resource whose policy is mandatory: it must admit the caller.
+ *
+ * Most AWS resources have no resource policy until someone writes one, and its
+ * absence simply leaves the decision to IAM. A KMS key is not like that: it
+ * always has a key policy, and an identity policy cannot reach the key unless
+ * that policy admits the caller. Services holding such a resource ask for this
+ * rule rather than IAM inferring it, because only the service knows its
+ * resource works that way.
+ *
+ * How the policy admits the caller decides what else is needed. A statement
+ * naming the caller grants access outright, which is why a KMS key policy can
+ * make a key usable by a Role with no permissions of its own. A statement
+ * naming the Account only delegates to that Account's IAM, so an identity
+ * policy still has to allow the action. That second case is the one the
+ * default key policy creates, and getting it wrong would make every key in the
+ * simulation usable by every principal in its Account.
+ */
+export declare class SimIamMandatoryResourcePolicyRequirement implements SimIamAllowRequirement {
+    /**
+     * Whether the resource's own policy admitted the caller, and whether
+     * anything further is needed for the way it did so.
+     */
+    isSatisfiedBy(allows: SimIamAllowSides): boolean;
+}
+/**
+ * Every applicable rule at once.
+ *
+ * A request can be subject to more than one: a cross-Account call against a
+ * KMS key has to satisfy both the cross-Account rule and the key's own
+ * mandatory-policy rule, and the stricter answer is the right one.
+ */
+export declare class SimIamEveryAllowRequirement implements SimIamAllowRequirement {
+    private readonly requirements;
+    constructor(requirements: readonly SimIamAllowRequirement[]);
+    /**
+     * Whether every rule is satisfied.
+     */
+    isSatisfiedBy(allows: SimIamAllowSides): boolean;
+}
 export {};
 //# sourceMappingURL=sim-iam-allow-requirement.d.ts.map

package/dist/service/iam/authorize/allow/sim-iam-allow-requirement.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"sim-iam-allow-requirement.d.ts","sourceRoot":"","sources":["../../../../../src/service/iam/authorize/allow/sim-iam-allow-requirement.ts"],"names":[],"mappings":"AAAA,UAAU,0BAA0B;IAClC,QAAQ,CAAC,QAAQ,EAAE,OAAO,CAAC;IAC3B,QAAQ,CAAC,QAAQ,EAAE,OAAO,CAAC;CAC5B;AAED;;;;;;;GAOG;AACH,qBAAa,gBAAgB;IAC3B,OAAO,CAAC,QAAQ,CAAC,eAAe,CAAU;IAC1C,OAAO,CAAC,QAAQ,CAAC,eAAe,CAAU;IAE1C,YAAY,UAAU,EAAE,0BAA0B,EAGjD;IAED;;OAEG;IACH,IAAI,QAAQ,IAAI,OAAO,CAEtB;IAED;;OAEG;IACH,IAAI,QAAQ,IAAI,OAAO,CAEtB;CACF;AAED;;GAEG;AACH,MAAM,WAAW,sBAAsB;IACrC,aAAa,CAAC,MAAM,EAAE,gBAAgB,GAAG,OAAO,CAAC;CAClD;AAED;;;;;;GAMG;AACH,qBAAa,gCAAiC,YAAW,sBAAsB;IAC7E;;OAEG;IACH,aAAa,CAAC,MAAM,EAAE,gBAAgB,GAAG,OAAO,CAE/C;CACF;AAED;;;;;;;GAOG;AACH,qBAAa,+BAAgC,YAAW,sBAAsB;IAC5E;;OAEG;IACH,aAAa,CAAC,MAAM,EAAE,gBAAgB,GAAG,OAAO,CAE/C;CACF"}
+{"version":3,"file":"sim-iam-allow-requirement.d.ts","sourceRoot":"","sources":["../../../../../src/service/iam/authorize/allow/sim-iam-allow-requirement.ts"],"names":[],"mappings":"AAAA,UAAU,0BAA0B;IAClC,QAAQ,CAAC,QAAQ,EAAE,OAAO,CAAC;IAC3B,QAAQ,CAAC,QAAQ,EAAE,OAAO,CAAC;IAE3B;;;OAGG;IACH,QAAQ,CAAC,cAAc,CAAC,EAAE,OAAO,GAAG,SAAS,CAAC;CAC/C;AAED;;;;;;;GAOG;AACH,qBAAa,gBAAgB;IAC3B,OAAO,CAAC,QAAQ,CAAC,eAAe,CAAU;IAC1C,OAAO,CAAC,QAAQ,CAAC,eAAe,CAAU;IAC1C,OAAO,CAAC,QAAQ,CAAC,qBAAqB,CAAU;IAEhD,YAAY,UAAU,EAAE,0BAA0B,EAKjD;IAED;;OAEG;IACH,IAAI,QAAQ,IAAI,OAAO,CAEtB;IAED;;OAEG;IACH,IAAI,QAAQ,IAAI,OAAO,CAEtB;IAED;;;OAGG;IACH,IAAI,cAAc,IAAI,OAAO,CAE5B;IAED;;;OAGG;IACH,IAAI,iBAAiB,IAAI,OAAO,CAE/B;CACF;AAED;;GAEG;AACH,MAAM,WAAW,sBAAsB;IACrC,aAAa,CAAC,MAAM,EAAE,gBAAgB,GAAG,OAAO,CAAC;CAClD;AAED;;;;;;GAMG;AACH,qBAAa,gCAAiC,YAAW,sBAAsB;IAC7E;;OAEG;IACH,aAAa,CAAC,MAAM,EAAE,gBAAgB,GAAG,OAAO,CAE/C;CACF;AAED;;;;;;;GAOG;AACH,qBAAa,+BAAgC,YAAW,sBAAsB;IAC5E;;OAEG;IACH,aAAa,CAAC,MAAM,EAAE,gBAAgB,GAAG,OAAO,CAE/C;CACF;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,qBAAa,wCAAyC,YAAW,sBAAsB;IACrF;;;OAGG;IACH,aAAa,CAAC,MAAM,EAAE,gBAAgB,GAAG,OAAO,CAM/C;CACF;AAED;;;;;;GAMG;AACH,qBAAa,2BAA4B,YAAW,sBAAsB;IACxE,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAoC;IAEjE,YAAY,YAAY,EAAE,SAAS,sBAAsB,EAAE,EAE1D;IAED;;OAEG;IACH,aAAa,CAAC,MAAM,EAAE,gBAAgB,GAAG,OAAO,CAI/C;CACF"}

package/dist/service/iam/authorize/allow/sim-iam-allow-requirement.js

@@ -9,9 +9,12 @@
 export class SimIamAllowSides {
     identityAllowed;
     resourceAllowed;
+    resourceDirectAllowed;
     constructor(properties) {
         this.identityAllowed = properties.identity;
         this.resourceAllowed = properties.resource;
+        this.resourceDirectAllowed =
+            properties.resourceDirect ?? properties.resource;
     }
     /**
      * Whether an identity-based policy allowed the request.
@@ -25,6 +28,20 @@ export class SimIamAllowSides {
     get resource() {
         return this.resourceAllowed;
     }
+    /**
+     * Whether a resource-based policy allowed the request by naming the caller,
+     * rather than by delegating to the caller's Account.
+     */
+    get resourceDirect() {
+        return this.resourceDirectAllowed;
+    }
+    /**
+     * Whether the resource's policy admitted the caller only by delegating to
+     * its Account, which grants nothing on its own.
+     */
+    get resourceDelegated() {
+        return this.resourceAllowed && !this.resourceDirectAllowed;
+    }
 }
 /**
  * The same-Account rule: an Allow from either side is enough.
@@ -57,4 +74,53 @@ export class SimIamBothSidesAllowRequirement {
         return allows.identity && allows.resource;
     }
 }
+/**
+ * The rule for a resource whose policy is mandatory: it must admit the caller.
+ *
+ * Most AWS resources have no resource policy until someone writes one, and its
+ * absence simply leaves the decision to IAM. A KMS key is not like that: it
+ * always has a key policy, and an identity policy cannot reach the key unless
+ * that policy admits the caller. Services holding such a resource ask for this
+ * rule rather than IAM inferring it, because only the service knows its
+ * resource works that way.
+ *
+ * How the policy admits the caller decides what else is needed. A statement
+ * naming the caller grants access outright, which is why a KMS key policy can
+ * make a key usable by a Role with no permissions of its own. A statement
+ * naming the Account only delegates to that Account's IAM, so an identity
+ * policy still has to allow the action. That second case is the one the
+ * default key policy creates, and getting it wrong would make every key in the
+ * simulation usable by every principal in its Account.
+ */
+export class SimIamMandatoryResourcePolicyRequirement {
+    /**
+     * Whether the resource's own policy admitted the caller, and whether
+     * anything further is needed for the way it did so.
+     */
+    isSatisfiedBy(allows) {
+        if (allows.resourceDirect) {
+            return true;
+        }
+        return allows.resourceDelegated && allows.identity;
+    }
+}
+/**
+ * Every applicable rule at once.
+ *
+ * A request can be subject to more than one: a cross-Account call against a
+ * KMS key has to satisfy both the cross-Account rule and the key's own
+ * mandatory-policy rule, and the stricter answer is the right one.
+ */
+export class SimIamEveryAllowRequirement {
+    requirements;
+    constructor(requirements) {
+        this.requirements = requirements;
+    }
+    /**
+     * Whether every rule is satisfied.
+     */
+    isSatisfiedBy(allows) {
+        return this.requirements.every((requirement) => requirement.isSatisfiedBy(allows));
+    }
+}
 //# sourceMappingURL=sim-iam-allow-requirement.js.map

package/dist/service/iam/authorize/allow/sim-iam-allow-requirement.js.map

@@ -1 +1 @@
-{"version":3,"file":"sim-iam-allow-requirement.js","sourceRoot":"","sources":["../../../../../src/service/iam/authorize/allow/sim-iam-allow-requirement.ts"],"names":[],"mappings":"AAKA;;;;;;;GAOG;AACH,MAAM,OAAO,gBAAgB;IACV,eAAe,CAAU;IACzB,eAAe,CAAU;IAE1C,YAAY,UAAsC;QAChD,IAAI,CAAC,eAAe,GAAG,UAAU,CAAC,QAAQ,CAAC;QAC3C,IAAI,CAAC,eAAe,GAAG,UAAU,CAAC,QAAQ,CAAC;IAC7C,CAAC;IAED;;OAEG;IACH,IAAI,QAAQ;QACV,OAAO,IAAI,CAAC,eAAe,CAAC;IAC9B,CAAC;IAED;;OAEG;IACH,IAAI,QAAQ;QACV,OAAO,IAAI,CAAC,eAAe,CAAC;IAC9B,CAAC;CACF;AASD;;;;;;GAMG;AACH,MAAM,OAAO,gCAAgC;IAC3C;;OAEG;IACH,aAAa,CAAC,MAAwB;QACpC,OAAO,MAAM,CAAC,QAAQ,IAAI,MAAM,CAAC,QAAQ,CAAC;IAC5C,CAAC;CACF;AAED;;;;;;;GAOG;AACH,MAAM,OAAO,+BAA+B;IAC1C;;OAEG;IACH,aAAa,CAAC,MAAwB;QACpC,OAAO,MAAM,CAAC,QAAQ,IAAI,MAAM,CAAC,QAAQ,CAAC;IAC5C,CAAC;CACF"}
+{"version":3,"file":"sim-iam-allow-requirement.js","sourceRoot":"","sources":["../../../../../src/service/iam/authorize/allow/sim-iam-allow-requirement.ts"],"names":[],"mappings":"AAWA;;;;;;;GAOG;AACH,MAAM,OAAO,gBAAgB;IACV,eAAe,CAAU;IACzB,eAAe,CAAU;IACzB,qBAAqB,CAAU;IAEhD,YAAY,UAAsC;QAChD,IAAI,CAAC,eAAe,GAAG,UAAU,CAAC,QAAQ,CAAC;QAC3C,IAAI,CAAC,eAAe,GAAG,UAAU,CAAC,QAAQ,CAAC;QAC3C,IAAI,CAAC,qBAAqB;YACxB,UAAU,CAAC,cAAc,IAAI,UAAU,CAAC,QAAQ,CAAC;IACrD,CAAC;IAED;;OAEG;IACH,IAAI,QAAQ;QACV,OAAO,IAAI,CAAC,eAAe,CAAC;IAC9B,CAAC;IAED;;OAEG;IACH,IAAI,QAAQ;QACV,OAAO,IAAI,CAAC,eAAe,CAAC;IAC9B,CAAC;IAED;;;OAGG;IACH,IAAI,cAAc;QAChB,OAAO,IAAI,CAAC,qBAAqB,CAAC;IACpC,CAAC;IAED;;;OAGG;IACH,IAAI,iBAAiB;QACnB,OAAO,IAAI,CAAC,eAAe,IAAI,CAAC,IAAI,CAAC,qBAAqB,CAAC;IAC7D,CAAC;CACF;AASD;;;;;;GAMG;AACH,MAAM,OAAO,gCAAgC;IAC3C;;OAEG;IACH,aAAa,CAAC,MAAwB;QACpC,OAAO,MAAM,CAAC,QAAQ,IAAI,MAAM,CAAC,QAAQ,CAAC;IAC5C,CAAC;CACF;AAED;;;;;;;GAOG;AACH,MAAM,OAAO,+BAA+B;IAC1C;;OAEG;IACH,aAAa,CAAC,MAAwB;QACpC,OAAO,MAAM,CAAC,QAAQ,IAAI,MAAM,CAAC,QAAQ,CAAC;IAC5C,CAAC;CACF;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,OAAO,wCAAwC;IACnD;;;OAGG;IACH,aAAa,CAAC,MAAwB;QACpC,IAAI,MAAM,CAAC,cAAc,EAAE,CAAC;YAC1B,OAAO,IAAI,CAAC;QACd,CAAC;QAED,OAAO,MAAM,CAAC,iBAAiB,IAAI,MAAM,CAAC,QAAQ,CAAC;IACrD,CAAC;CACF;AAED;;;;;;GAMG;AACH,MAAM,OAAO,2BAA2B;IACrB,YAAY,CAAoC;IAEjE,YAAY,YAA+C;QACzD,IAAI,CAAC,YAAY,GAAG,YAAY,CAAC;IACnC,CAAC;IAED;;OAEG;IACH,aAAa,CAAC,MAAwB;QACpC,OAAO,IAAI,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC,WAAW,EAAE,EAAE,CAC7C,WAAW,CAAC,aAAa,CAAC,MAAM,CAAC,CAClC,CAAC;IACJ,CAAC;CACF"}